railiance-platform/history/2026-09-06-backup-tiers-implementation.md

Backup tiers implementation and recovery evidence

Implemented and live-verified the two data paths under WP-0038-T04. The full 5.35 GB encrypted archive now has a separate Scaleway application-archive copy and passed actual retrieval, decryption and isolated Forgejo recovery, including all 2,040 package blob hashes. Native database backup remains independently active.

The explicit essentials profile produced a 286,298,520-byte encrypted archive (273 MiB), about 94.7% smaller. It preserves all 142 repository roots, database, configuration and unique-data categories. The manifest declares omitted packages, generated archives/indexes/logs and the reduced recovery contract. Its real Nextcloud round trip and isolated recovery passed with package service disabled, 142 repository records, six users, and two successful Git clone/fsck checks. The newer essentials database has 2,050 blob metadata records; these two captures are different recovery points, not a synchronized full/essential pair.

Public pinned recovery images were fetched without the production registry or Scaleway. Inventory found 21 container, two npm and two Python packages; no blanket rebuildability claim is made. Five other database clusters total about 209 MiB physical storage, a sizing input rather than compressed backup coverage proof.

Implemented tested retention planning and a separate attended owner executor: protected recovered anchor, known verified names only, incoming headroom, retained-object checks, ciphertext anchor revalidation, conditional ETag deletion and a single-writer local lock. Workload delivery remains create-only. No retained full archive or provider retention setting was changed.

Initial capture/transfer attempts failed before useful diagnostics; safe stage and exception-type diagnostics were added. Retried operations passed. Their precise initial failure cause was not established. No raw captured credential outputs were inspected or recorded.

Remaining T04 gate is operational activation: bind durable scheduling/caller and its dependencies, canonical generation names and verified inventory, plus the separate owner retention/fresh-quota operation. Current local cron still invokes the old full-to-Nextcloud helper. This turn's manual tests do not close recurring primary coverage or authorize silently dropping a recovery component.

Evidence is under docs/evidence/RPF-WP-0038-*.json; the complete operational contract and limitations are in docs/backup-storage-tiers.md.

All 221 repository tests passed. Removed the three drill plaintext ZIPs after verified recovery; all good encrypted copies and provider backups remain. Current create-only workload credentials cannot perform owner quota/expiration. The new owner executor remains attended; no owner password or new delete grant was delivered to a workload. Operational binding remains explicit in T04.